Printable View
we plan to setup virtual OS environments using VMWARE and infect the virtual OS with viruses & malware. we are going to make instructional videos from the VM's for users to show them the damage potential if they don't apply common sense and due care.
where can we go to get viruses?
p.s. this is going to work, right? i assume if you lauch malicious code within a VMWARE session - is can't escape the VM.
If I am not mistaken as long as the virus is on the hard drive of the computer it will be unbiased as to where it spreads. My suggestion for things like this are to set up a few boxes (depending on how many you need) create images of how they are, infect them all you want, then just reimage them when you are done just to be safe.Quote:
this is going to work, right? i assume if you lauch malicious code within a VMWARE session - is can't escape the VM.
you have several options. you can go hunting for them and jump on kazaa or some other p2p program and download random files that look suspicious, maybe a sear for "*.mp3.exe" or something. You can create an unpatched windows box and toss it on the open net and go surfing to random not so legit webpages and im sure you will pick up some good stuff. You can contact other organizations that do this type of research and they probably have some disks with "controled" viruses on them.Quote:
where can we go to get viruses?
Hang around the doctor's office, and get people to breathe on you. :DQuote:
p2p networks are a good place. If you do use something like kazaa lite, make sure to remove the filters. They have put a lot of double extentions into the search filters to help try to thwart the spread of viruses on the p2p networks.
There are plenty of sites out there that have viruses archived.
You can even find the source code to serveral.
Surf some "shady sites" with an unpatched Internet Explorer.
Neg's got one for you.
http://www.antionline.com/showthread...665#post844665
:eek:
Cheers:
I don't want to sound rude, but is this really a good idea? Are you sure this is safe?
Not the process itself...don't get me wrong rowdy but if you have to ask where to get the viruses, it reduces my confidence in your abilities to properly manage this hostile environment you've described.
How do you plan to infect the virtual systems, and not the host itself? How are you going to keep the virtual systems from infecting other devices on your network? How are you going to ensure the video data of these activities is not infected when transfered for production and preparation for use in training?
XTC46 is right:
The way VMWare works is it bridges the components of the host to include networking to make it a virtual machine.Quote:
If I am not mistaken as long as the virus is on the hard drive of the computer it will be unbiased as to where it spreads.
VX Heaven (http://vx.netlux.org/) is a place I used to visit back when I used to look for things to play with and read 29a Labs zine issues. They keep a decent archieve of malware (mostly non-spyware/adware) pieces around. For spyware and adware, I usually just look for lists of software that contain pieces that I'd be interested in and hunt down the programs that contain the unwelcomed guests.
Hope this helps and be safe.
Just reading this makes me think of the guy who asks if it will hurt if he shoots himself in the foot.Quote:
p.s. this is going to work, right? i assume if you lauch malicious code within a VMWARE session - is can't escape the VM.
Now, the real answer is, "it depends". The payload of the virus dictates the action. If you're talking worms and malware, these guys are going to use networking to spread so get ready to explain to your CEO why there was a mass outbreak within your organization.
FREE SAFETY TIP:
Get an isolated lab environment.
Use samples of worms/viruses/malcode that have a *known* payload. This way you can watch it using a sniffer, etc.
That said, here is a free online library of virus/worm/malware samples:
http://vx.netlux.org/
BE CAREFUL.
<EDIT> Optiq hit POST just before I did. He beat me to the punch on the VX Heaven site.
good stuff. thanks to all.
we are losing the battle of user awareness. so we thought we would try a more "spectacular" awareness program approach. show them how destructive things can get but contain it in a controled environment.
am aware of kaaza e.t.c.. thought i would try you guys to see if you might have some better places.
most probably am going to do this on a machine that isn't connected to ethernet.
i just really like the idea of creating an avi file from the VM as the virus does damage. sort of showing a before and after picture. will need to hunt for a "spectaular" virus whose damage payload on the file system looks impressive on screen.
cheers.
:-)
Another site where you can go to not get malware, but to get videos of the malware being installed, is the site of Ben Edelman. He's got some videos of this exact same thing: going to a web site and having dozens of pieces of malware being installed without user intervention on his test machines. This kind of thing is something he likes to do. For example, go to this page on his site to download the videos of the IBIS toolbar being installed. I know he's got several videos of different spyware progs being installed.
update:
i tired it. it didn't work as well as I had hoped. I kind-a "munged" the entire host system. But I had the smarts to not have it be able to communicate with the rest of the network so damaga was localized to the munged system.
live & learn.
:-)
Right... :rolleyes:Quote:
just really like the idea of creating an avi file from the VM as the virus does damage. sort of showing a before and after picture. will need to hunt for a "spectaular" virus whose damage payload on the file system looks impressive on screen.
You want to keep users informed by opening malware.exe to see all of the "pretty colors and to hear funny sounds". Boy won't people be disappointed when I end up stealing small amounts of space, CPU cycles, and bandwidth without them knowing or even so much as giving a rats ass.
I agree with the specialist 100 percent.
yeah, but we have to do something about it. it's costing us network support time in file & system restores. in some cases complete system re-haul.
anyway, no biggie. i make a clean ghost image pre-mung - so bringing the system back to clean state is just a < 10min job. all the test sys has is WinXP with out any apps. the image is tiny compared to the production machine with > 6 gigs of data - thats before the user has even touched it.
Their's various worms and trojans from here http://www.thenetworkadministrator.c...ackertools.htm
Why reinvent the wheel? You have acceptable use policies and statements? You need to apply them. A couple of wrist slaps and signed forms of 'warning of non-compliance' will start to get the message out, and when that doesn't work well enough, some disciplinary action should do the trick. If your management won't sign off, you have a serious problem, which no amount of user education or entertainment will fix.Quote:
Originally posted here by rowdy_yates
yeah, but we have to do something about it. it's costing us network support time in file & system restores. in some cases complete system re-haul.
start billing the employee's for "company time lost due to negligence". If they cannot follow simple guidelines and have chronic virus problems then it is a problem with their computer habbits.Quote:
yeah, but we have to do something about it. it's costing us network support time in file & system restores. in some cases complete system re-haul.
if you want it to look spectacular don't use a real virus, just make yer own virus wich only does the pretty colours and ****... people don't understand subtle filesystem modifications and small extra programms starting... they do however understand 10000 spyware programms cripling their computer with just their number
aye, i hear you mate. we do have some mgtm problems.Quote:
Originally posted here by zencoder
Why reinvent the wheel? You have acceptable use policies and statements? You need to apply them. A couple of wrist slaps and signed forms of 'warning of non-compliance' will start to get the message out, and when that doesn't work well enough, some disciplinary action should do the trick. If your management won't sign off, you have a serious problem, which no amount of user education or entertainment will fix.
it is a little like the gov. saying, "we have a major deficit! we have major homelessness problem. we have to do something about it and we have to do something about it right now!"
and everyone keeps pretending to do something about it - but no one really wants to "really" do anything about it - so everyone just keeps on talking about how they are going to do something about it "right now". and this just keeps on going on and on for years and years. in the meantime we all keep collecting our pay cheques and we all keep on talkin'... ah.. the real world really sucks.
http://www.sirkussystem.com/virus.html
You'll like it.
howdy. i thought to start a new thread - but it seems to be in conext so i will stick here..
i got me a live virus.
my question, it's basically a pif file. file name is something like
i opened it in a text editor. it's all gibberish. what can I open this with so I can look at it? do i have to reverse engineer it?
There are a number of solutions to this problem.
As was mentioned, you can hit a website and download malware to play with OR you can do some other more interesting things...
Some things I've done..Join multiple mailing or user groups and ask for malware submittals. Once you've gained the trust of others in the groups this isn't a problem.
Set up a honeypot. These are great tools, and will teach you more than downloading executables ever will. They are a lot of fun too!
Rowdy, no you don't have to reverse engineer it, but that would be the best way to really understand how it works. Generally speaking, strings.exe(or unix strings) would be the best way to take a quick look at the file. Malware analysis is a topic that's probably best talked about in another thread.